{
 "id": "AIR-2026-0049",
 "slug": "cve-2026-70493-open-webui-vulnerable-to-regular-expression-d",
 "title": "CVE-2026-70493: Open WebUI vulnerable to regular expression denial of service",
 "summary": "From version 0.9.6 until 0.11.0, Open WebUI allowed chat participants to supply regex patterns that could cause excessive CPU consumption and block the event loop. This flaw was resolved in version 0.11.0.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-08-04",
 "incident_date_precision": "day",
 "first_reported": "2026-08-04",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70493",
   "publisher": "NVD",
   "title": "CVE-2026-70493: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform.",
   "published_at": "2026-08-04"
  },
  {
   "url": "https://github.com/advisories/GHSA-2f54-p244-32q6",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-70493: Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically",
   "published_at": "2026-08-04"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-70493",
  "open-webui",
  "redos"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T07:00:14.101Z"
}